Guides/How to handle GDPR deletion for form data

How to handle GDPR deletion for form data

Delete by email. One API call. Gone.

Updated March 2026

Someone asks you to delete their data. GDPR says you do it. Sutrena has a deletion endpoint that removes submissions matching a specific email address. One call, the data is gone. This guide covers the call, verification, and what to think about.

1. Identify the user and their data

When you get a deletion request, figure out which forms the user submitted to. Search submissions by email across your forms.

# List submissions for a specific form filtered by email:
curl "https://sutrena.com/api/forms/frm_xyz789/[email protected]" \
  -H "Authorization: Bearer st_live_your_key"

# Check multiple forms by listing all forms first:
curl https://sutrena.com/api/forms \
  -H "Authorization: Bearer st_live_your_key"

2. Delete submissions by email

Call the deletion endpoint with the email. Permanently removes all submissions from that user for the specified form. Irreversible.

curl -X DELETE \
  "https://sutrena.com/api/forms/frm_xyz789/[email protected]" \
  -H "Authorization: Bearer st_live_your_key"

# Response:
# {
#   "deleted": 3,
#   "message": "3 submissions deleted for [email protected]"
# }

3. Verify the deletion

Query for that email again to confirm nothing remains. Document it for your compliance records.

# Verify no submissions remain:
curl "https://sutrena.com/api/forms/frm_xyz789/[email protected]" \
  -H "Authorization: Bearer st_live_your_key"

# Response should show empty results:
# { "submissions": [], "total": 0 }

FAQ

Is the deletion permanent?

Yes. No soft-delete, no recycle bin. Once you call it, it is gone. Make sure you have confirmed the request first.

Can I delete a single submission by ID?

Yes. DELETE /api/forms/:formId/submissions/:submissionId removes one specific submission.

Does this delete data from dashboards too?

Dashboards compute from live submission data. Delete the submissions and the charts update on the next refresh.

How long does deletion take?

Immediate. The call is synchronous. Returns the count of what was deleted.

Do I need to delete data from Nishkala separately?

No. Sutrena handles all the storage. The deletion API takes care of everything.

Related

Form submissions API →Export before deleting →What is a headless form backend? →Plan limits →

What is Sutrena?

Sutrena is the web runtime for AI agents. Three primitives — pages, forms, and dashboards — accessible through one API. Your agent creates web artifacts, humans interact with them, and your agent gets the data back. Framework-agnostic. Works from any MCP client or HTTP client.

Get started in two API calls

1. Get a trial key (no auth, no signup)

curl -X POST https://sutrena.com/api/trial

2. Create a form + dashboard from a template

curl -X POST https://sutrena.com/api/forms \
  -H "Authorization: Bearer st_trial_xxx" \
  -H "Content-Type: application/json" \
  -d '{"templateId": "waitlist", "createDashboard": true}'
/llms.txt/api/schema/llms-full.txt/.well-known/mcp.json

Ready to build?

Get a trial API key instantly with no signup, or create an account for the full experience.

Start buildingAgent docs
How to handle GDPR deletion for form data — Sutrena | Sutrena